Help!! Getting the following....AppData\Roaming\Adobe\sp.DLL

KaisorSoze · Oct 3, 2012

Hello

I am a little confused. This is the 3rd time I have recented a virus/malware from a simple search using the google search site. After finding what i was looking for, i clicked on the link and got a virus. My antivirus was detecting it and said it got rid of it, but when restarting i am getting an error message (red stop sign) showing C:\Users\Kamanny\AppData\Roaming\Adobe\sp.DLL

After running scans, my antivirus doesnt pop up anymore, but i still get the error message from Windows.

My logs are attached. Thanks for help.

TimW · Oct 4, 2012

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][SUSP PATH] HKCU\[...]\Run : sp (C:\Windows\sysWOW64\rundll32.exe "C:\Users\Kamanny\AppData\Roaming\Adobe\sp.DLL",ServiceMain) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-2124000455-1831981346-3834430383-1000[...]\Run : sp (C:\Windows\sysWOW64\rundll32.exe "C:\Users\Kamanny\AppData\Roaming\Adobe\sp.DLL",ServiceMain) -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default User : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot and re-scan with RogueKiller. Attach that log as well.

KaisorSoze · Oct 6, 2012

Thanks for the response. I no longer get the warning window while booting up, nor does my antivirus provides a popup window. i havent tried searching for something on google, as it was allowing me to search, but redirecting me when i click on what i was looking for.

Logs attached.

TimW · Oct 6, 2012

Might as well fix these while we are at it:
Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot and re-scan with RogueKiller. Attach that log as well.

Make sure you tell me how things are running now.

KaisorSoze · Oct 7, 2012

Things seem to be fine. I did a couple of searches and they were not redirected, nor do i get the alert message again.

TimW · Oct 8, 2012

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Go to the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Log in or Sign up

Help!! Getting the following....AppData\Roaming\Adobe\sp.DLL

KaisorSoze Private E-2

Attached Files:

HitmanPro_20121003_1741.log

RKreport[1].txt

MGlogs.zip

mbam-log-2012-10-03 (17-15-39).txt

TDSSKiller.2.8.10.0_03.10.2012_17.32.23_log.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

KaisorSoze Private E-2

Attached Files:

RKreport[3].txt

RKreport[4].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

KaisorSoze Private E-2

Attached Files:

RKreport[6].txt

RKreport[7].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member